#!/bin/sh
# q20-kit: one-shot root fix on Mint
#  1) harden sshd (key-only)   2) hand funnel control to the user   3) open the public TCP entry
set -e
CONF=/etc/ssh/sshd_config.d/99-q20-kit.conf
printf 'PasswordAuthentication no\nPermitRootLogin prohibit-password\nPubkeyAuthentication yes\n' > "$CONF"
chmod 644 "$CONF"
systemctl restart ssh
echo "== sshd effective:"
sshd -T 2>/dev/null | grep -iE '^(passwordauthentication|permitrootlogin|pubkeyauthentication)' || true
echo "== tailscale operator:"
tailscale set --operator=ragecks && echo "operator=ragecks OK"
echo "== funnel:"
tailscale funnel --bg --tcp=10000 tcp://localhost:22 || echo "(funnel cmd rc=$?)"
tailscale funnel status || true
echo "ROOT_FIX_DONE"